Re-organize IPC channel reset and mailbox interrupt handling code to
fix race condition where KMD was receiving new msg from DCE while
processing previous msg and clearing mailbox interrupt as part of it.
which was causing wait_for_ipc to get stuck.
JIRA TDS-6381
Change-Id: Ibd6ab1758d9b5b2e3709a03dadbc84f2585653a4
Signed-off-by: Mahesh Kumar <mahkumar@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/c/linux-t23x/+/2460641
Reviewed-by: Santosh Galma <galmar@nvidia.com>
Reviewed-by: Arun Swain <arswain@nvidia.com>
Reviewed-by: mobile promotions <svcmobile_promotions@nvidia.com>
GVS: Gerrit_Virtual_Submit
Tested-by: mobile promotions <svcmobile_promotions@nvidia.com>
For T23x, we have a separate R5 based cluster
named as Display Controller Engine(DCE) to run
our Display RM code. This driver will run on CPU
with the following functionality:
Via debugfs for test and bring-up purposes:
1. Reads the DCE firmware image into DRAM.
2. Sets up DCE AST to cover the DCE firmware image.
3. Sets up R5 reset vector to point to DCE firmware
entry point
4. Brings DCE out of reset
5. Dumps various regsiters for debug
In production env:
1. Manages interrupts to CPU from DCE
2. Uses bootstrap command interface to define Admin
IPC
3. Locks down bootstrap command interface
4. Uses Admin IPC to define message IPC
5. Uses Admin IPC to define message IPC payload area
6. Uses Admin IPC to set IPC channels
6. Uses Admin IPC to define crashdump area
(optional)
7. Provides IPC interfaces for any DCE Client running
on CCPLEX including Display RM.
8. Uses Admin IPC to set logging level (optional)
This patch puts a framework in place with the
following features :
1. Firmware Loading
2. AST Configuration
3. DCE Reset with EVP Programming
4. Logging Infra
5. Debugfs Support
6. Interrupt Handling
7. Mailbox Programming
8. IPC Programming
9. DCE Client Interface
10. Ftrace Support for debug purposes
Change-Id: Idd28cd9254706c7313f531fcadaa7024a5b344e7
Signed-off-by: Arun Swain <arswain@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/c/linux-t23x/+/2289865
Reviewed-by: automaticguardword <automaticguardword@nvidia.com>
Reviewed-by: Mahesh Kumar <mahkumar@nvidia.com>
Reviewed-by: Santosh Galma <galmar@nvidia.com>
Reviewed-by: Mitch Luban <mluban@nvidia.com>
Reviewed-by: mobile promotions <svcmobile_promotions@nvidia.com>
GVS: Gerrit_Virtual_Submit
Tested-by: Mahesh Kumar <mahkumar@nvidia.com>
Tested-by: mobile promotions <svcmobile_promotions@nvidia.com>
local variables size is more then recommended values leading
to compilation warning. So usign this patch we are fixing
below compilation warnigs:-
nvidia-oot/drivers/crypto/tegra-nvvse-cryptodev.c:
In function ‘tnvvse_crypto_dev_ioctl’:
nvidia-oot/drivers/crypto/tegra-nvvse-cryptodev.c:2103:1:
warning: the frame size of 2224 bytes is larger than 2048 bytes
[-Wframe-larger-than=]
Bug 4064812
Change-Id: Ie5f0489c9733451f9a132e146790a18d3dd4d6f9
Signed-off-by: Manish Bhardwaj <mbhardwaj@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/c/linux-nv-oot/+/2887287
Reviewed-by: Ashutosh Patel <ashutoshp@nvidia.com>
Reviewed-by: svc-mobile-coverity <svc-mobile-coverity@nvidia.com>
Reviewed-by: svc-mobile-cert <svc-mobile-cert@nvidia.com>
Reviewed-by: Sandeep Trasi <strasi@nvidia.com>
GVS: Gerrit_Virtual_Submit <buildbot_gerritrpt@nvidia.com>
Merge nvmap driver from kernel/nvidia to kernel/nvidia-oot
to get rid of kernel/nvidia for OOT drivers.
Merge remote-tracking branch
'origin/dev/ldewangan/nvidia-nvmap-dev-main'
into
oot-nvidia-nvmap-dev-main
Changes merged are:
3059baed0 video: tegra: nvmap: Resolve incorrect check
b20790d77 video: tegra: nvmap: Fix data race for RO dma-buf
fba5e4766 video: tegra: nvmap: Fix build for Linux v6.3
6fd5f8966 video: tegra: nvmap: Fix overflow condition
47077f96f video: tegra: nvmap: Update contig flag check
49628c223 video: tegra: nvmap: Fix data race for RO dma-buf
73e81759d video: tegra: nvmap: Fix error pointer dereference
2c51bb8eb video: tegra: nvmap: Fix kmemleak issues
a2e6ee293 tegra:nvmap: do not export symbol for init functions
4629804ea video: tegra: nvmap: Remove use of bitmap_allocate_region
ffb301fb9 video: tegra: nvmap: Fix kmemleak issue
86a33032e nvmap: Don't free pages while freeing subhandle
06bf4d6ac nvmap: Fix coherency issues while creating subhandle
064bf50f9 nvmap: Add traces for big pages in page pool
dcac1c0a9 nvmap: Use same nvmap client for namespaces in a process
3a59e1982 video: tegra: nvmap: Make NvMap load based on DT
d703b19fe nvmap: Fix type casting issue
d6b9b8d21 nvmap: Fix type casting issue
3dbdad35c nvmap: Fix type casting issue
eebe13973 tegra: nvmap: dmabuf fd for range from list of handles
699708288 video: tegra: nvmap: Remove unused code
9a13e1eb9 nvmap: Remove use of __dma_flush_area
cc519075b nvmap: Register nvmap device towards end of probe
66b9a3912 nvmap: Keep cache flush at allocation time only
34ec2845a tegra: nvmap: make sciipc_id as 64 bit
bed3861b1 tegra: nvmap: add _dma_*area prototype
0ae70ffd0 tegra: nvmap: fix build for kernel 6.0
d826f0508 video: tegra: nvmap: Fix type casting issue
003efb449 tegra: nvmap: replace _dma_* and __iomap
Bug 4038415
Change-Id: I43422655bf7b28f215902d4c01f21d99c579a97d
Signed-off-by: Laxman Dewangan <ldewangan@nvidia.com>
When one process is trying to duplicate RO handle while other process is
trying to free the same RO handle, then race can occur and second
process can decrement the dma-buf's refcount and it may reach to 0. The
first process can then call get_dma_buf on it, leading to NULL pointer
dereference and ultimately to kernel panic. Fix this by taking an extra
dma-buf refcount before duplicating the handle and then decrease it once
duplication is completed.
Bug 3991243
Change-Id: I99901ce19d8a5d23c5192cb10a17efd2ebaf9d3a
Signed-off-by: Ketan Patil <ketanp@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/c/linux-nvidia/+/2865519
Reviewed-by: svc_kernel_abi <svc_kernel_abi@nvidia.com>
Reviewed-by: svcacv <svcacv@nvidia.com>
Reviewed-by: Krishna Reddy <vdumpa@nvidia.com>
GVS: Gerrit_Virtual_Submit <buildbot_gerritrpt@nvidia.com>
When the carveout size is changed to 2GB, mem->size << PAGE_SHIFT will
overflow the int limit and get wrapped to negative value. Hence
during freeing bitmap, one of the comparison condition is not meeting,
resulting into not freeing bitmap. Ultimately the entire bitmap get
consumed even though it is expected to have empty bits. Fix this by
typecasting the size to u64.
Bug 3962552
Change-Id: Ieaf93a3a91062d3f630921259aa9b3935853e91c
Signed-off-by: Ketan Patil <ketanp@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/c/linux-nvidia/+/2861614
Reviewed-by: svcacv <svcacv@nvidia.com>
Reviewed-by: svc_kernel_abi <svc_kernel_abi@nvidia.com>
Reviewed-by: svc-mobile-coverity <svc-mobile-coverity@nvidia.com>
Reviewed-by: svc-mobile-cert <svc-mobile-cert@nvidia.com>
Reviewed-by: Sachin Nikam <snikam@nvidia.com>
GVS: Gerrit_Virtual_Submit <buildbot_gerritrpt@nvidia.com>
There is a potential data race for RO dma-buf in the following scenario:
------------------------------------------------------------------
Process 1 | Process 2 | Process 3 |
------------------------------------------------------------------|
AllocAttr handle H1 | | |
MemMap (H1) | | |
AllocAttr(H2) | | |
MemMap(H2) | | |
id1 = GetSciIpcId(H1)| | |
id2 = GetSciIpcId(H2)|H3=HandleFromSciIpcId | |
id3 = GetSciIpcId(H1)| (id1, RO) |H4=HandleFromSciIpcId|
MemUnmap(H2) |QueryHandlePararms(H3)|(id2, RO) |
MemUnmap(H1) |MemMap(H3) |QueryHandleParams(H4)|
HandleFree(H2) |MemUnmap(H3) |MemMap(H4) |
HandleFree(H1) |HandleFree(H3) |H5=HandleFromSciIpcId|
| |(id3, RO) |
| |QueryHandleParams(H5)|
| |MemMap(H5) |
| |MemUnmap(H4) |
| |MemUnmap(H5) |
| |HandleFree(H4) |
| |HandleFree(H5) |
-------------------------------------------------------------------
The race is happening between the HandleFree(H3) in process 2 and
HandleFromSciIpcId(id3, RO) in process 3. Process 2 tries to free the
H3, and function nvmap_free_handle decrements the RO dma-buf's counter,
so that it reaches 0, but nvmap_dmabuf_release is not called immediately
because of which the process 3 get's false value for the following check
if (is_ro && h->dmabuf_ro == NULL)
It results in calling nvmap_duplicate_handle and then meanwhile function
nvmap_dmabuf_release is called and it makes h->dmabuf_ro to NULL. Hence
get_dma_buf fails with null pointer dereference error.
Fix this issue with following approach:
- Before using dmabuf_ro, take the handle->lock, then check if it is not
NULL.
- If not NULL, then call get_file_rcu on the file associated with RO
dma-buf and check return value.
- If return value is false, then dma-buf's ref counter is zero and it is
going away. So wait until dmabuf_ro is set to NULL; and then create a
new dma-buf for RO.
- Otherwise, use the existing RO dma-buf and decrement the refcount
taken with get_file_rcu.
Bug 3741751
Change-Id: I8987efebc476a794b240ca968b7915b4263ba664
Signed-off-by: Ketan Patil <ketanp@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/c/linux-nvidia/+/2850394
Reviewed-by: svcacv <svcacv@nvidia.com>
Reviewed-by: svc_kernel_abi <svc_kernel_abi@nvidia.com>
Reviewed-by: svc-mobile-coverity <svc-mobile-coverity@nvidia.com>
Reviewed-by: Krishna Reddy <vdumpa@nvidia.com>
GVS: Gerrit_Virtual_Submit <buildbot_gerritrpt@nvidia.com>
NvMap is using bitmap_allocate_region while doing allocation from IVM
carveout. It expects size to be always power of 2, this is resulting
into memory shortage. Better way to handle this is to use the function
bitmap_find_next_zero_area which expects bitmap size rather than order.
Then use bitmap_set to set the allocated bits from the bitmap.
Similarly, while freeing the buffer, use bitmap_clear instead of
bitmap_release_region.
Bug 3923812
Change-Id: I91005d16f678405f341c4fc620509f56af538e1c
Signed-off-by: Ketan Patil <ketanp@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/c/linux-nvidia/+/2839848
Reviewed-by: svc_kernel_abi <svc_kernel_abi@nvidia.com>
Reviewed-by: Ashish Mhetre <amhetre@nvidia.com>
Reviewed-by: Sachin Nikam <snikam@nvidia.com>
GVS: Gerrit_Virtual_Submit <buildbot_gerritrpt@nvidia.com>
get_task_struct increment the ref count over task struct, and it will be
decremented as part of put_task_struct. task_struct won't be freed
unless it's refcount becomes 0. Hence the missing put_task_struct in
nvmap code was resulting into kmemleak. Fix it by add this missing call.
Also, mutex_unlock was missing in one of the return path, add it.
Bug 3901618
Change-Id: I630eac19e628a549179a8ddaad86ad4d2c9b9a53
Signed-off-by: Ketan Patil <ketanp@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/c/linux-nvidia/+/2837383
Reviewed-by: svcacv <svcacv@nvidia.com>
Reviewed-by: Ashish Mhetre <amhetre@nvidia.com>
Reviewed-by: Sachin Nikam <snikam@nvidia.com>
GVS: Gerrit_Virtual_Submit <buildbot_gerritrpt@nvidia.com>
This patch fixes the following issues:
- When the handle associated with the sub-buffer is freed, the call to
the nvmap_page_pool_fill_lots is made, which would free the pages when
the refcount on the pages is > 1, even though the main handle is not
freed, hence add a check for sub-handle.
- In cpu unmap code, list_for_each_entry is used for iterating over the
vma list and in the same loop list_del is aldo being called, this can
lead to undefined behavior, instead use list_for_each_entry_safe which
is safe against removal of list entry.
- Mutex of sub-handle is not initialized, fix it by initializing it.
- Set error value when handle creation failed.
Bug 3494980
Change-Id: I0659d7f70b44814e87e3081702352e891d9191f7
Signed-off-by: Ketan Patil <ketanp@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/c/linux-nvidia/+/2824668
Reviewed-by: svc-mobile-coverity <svc-mobile-coverity@nvidia.com>
Reviewed-by: svc_kernel_abi <svc_kernel_abi@nvidia.com>
Reviewed-by: Puneet Saxena <puneets@nvidia.com>
Reviewed-by: Sachin Nikam <snikam@nvidia.com>
GVS: Gerrit_Virtual_Submit <buildbot_gerritrpt@nvidia.com>
Some of the libraries may be linked into different namespaces, but they
belong to same process. So each namespace can open the /dev/nvmap node
and call nvmap ioctls, instead of reusing the already opened /dev/nvmap
FD. Because of this, memory handles created by one namespace can't be
used by other namespaces, even though they belong to same process.
Fix this issue by following:
- When /dev/nvmap node is opened, check if there is already any nvmap
client with same pid, if yes use that client; otherwise, create new
nvmap client.
- Track the number of namespaces via count field.
- When /dev/nvmap node is closed, destroy the nvmap client only when
count reaches to 0.
Bug 3689604
Change-Id: I4c91db36b88e78b7526dd63b006e562c8f66c7ae
Signed-off-by: Ketan Patil <ketanp@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/c/linux-nvidia/+/2819915
Reviewed-by: svc-mobile-coverity <svc-mobile-coverity@nvidia.com>
Reviewed-by: svc_kernel_abi <svc_kernel_abi@nvidia.com>
Reviewed-by: Krishna Reddy <vdumpa@nvidia.com>
Reviewed-by: Ivan Raul Guadarrama <iguadarrama@nvidia.com>
GVS: Gerrit_Virtual_Submit <buildbot_gerritrpt@nvidia.com>
On TOT, in nvmap probe function, platform_set_drvdata is called after
misc register. So nvmap node is created and clients can open it even
before platform driver data is set. Because of which, the call to
dev_get_drvdata returns NULL and BUG_ON condition is hit. Move misc
register call towards end of the nvmap probe, so that /dev/nvmap is
exposed once all initilization is completed.
As misc register being moved to end of probe, the functions which are
called before misc register and which make use of dev_user field from
nvmap_device for calling dev_err/dev_info function will see the dev
field as NULL. Hence replace such calls with pr_err/pr_info.
Bug 3853486
Change-Id: Ifdd8443812a621aceada7739cf9b02fcf00568b4
Signed-off-by: Ketan Patil <ketanp@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/c/linux-nvidia/+/2803672
Reviewed-by: svc-mobile-coverity <svc-mobile-coverity@nvidia.com>
Reviewed-by: svc-mobile-cert <svc-mobile-cert@nvidia.com>
Reviewed-by: svc_kernel_abi <svc_kernel_abi@nvidia.com>
Reviewed-by: Sachin Nikam <snikam@nvidia.com>
GVS: Gerrit_Virtual_Submit <buildbot_gerritrpt@nvidia.com>
On TOT, in case of carveouts, nvmap performs cache flush operation
during carveout creation, buffer allocation and buffer release. Due to
cache flush for entire carveout at creation time, nvmap takes ~430 ms
for probe. This is affecting boot KPIs.
Fix this by performing cache flush only at buffer allocation time,
instead of carveout creation and buffer release. This is reducing nvmap
probe time to ~0.69 ms.
Bug 3821631
Change-Id: I54da7dd179f8d30b8b038daf3eceafb355b2e789
Signed-off-by: Ketan Patil <ketanp@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/c/linux-nvidia/+/2802353
Reviewed-by: svc-mobile-coverity <svc-mobile-coverity@nvidia.com>
Reviewed-by: Bharat Nihalani <bnihalani@nvidia.com>
Reviewed-by: Sachin Nikam <snikam@nvidia.com>
Reviewed-by: Ashish Mhetre <amhetre@nvidia.com>
GVS: Gerrit_Virtual_Submit <buildbot_gerritrpt@nvidia.com>
